Which Command Should the Administrator Use Practice Questions

show interfaces status

Why it fails: show interfaces status displays speed, duplex, and VLAN assignment for each port, but it does not show Spanning Tree Protocol states. It can indicate connected or notconnected, but not whether STP has blocked a port. This command is useful for physical layer verification, not for detecting STP topology changes or loops.

show running-config

Why it fails: show running-config displays the current configuration, including STP settings, but it does not show operational STP states or port roles. It can confirm if STP is enabled, but not whether ports are currently blocking. For real-time STP status, operational commands like show spanning-tree are required.

show mac address-table

Why it fails: show mac address-table lists MAC addresses learned per port. A loop can cause MAC address flapping, where the same MAC appears on multiple ports, but this command alone does not show STP states. While useful for detecting flapping, it does not directly verify whether STP has blocked ports to prevent a loop.

Reconfigure the default gateway on all hosts in VLAN 20 to point to the VLAN 40 SVI address.

Why it fails: Hosts should point to the gateway address of their own VLAN, not to another VLAN's interface. Changing VLAN 20 clients to use the VLAN 40 SVI would break their existing connectivity to VLAN 30 as well. This misconfiguration would widen the outage instead of fixing the VLAN 40 reachability problem.

Replace the Layer 3 switch with a router that has physical interfaces for each VLAN.

Why it fails: Replacing hardware is a drastic action that ignores diagnosis. The existing Layer 3 switch already routes between two working VLANs, so its routing capability is proven. The failure is isolated to one destination VLAN, which points to a configuration or status issue rather than a hardware limitation. This step would disrupt the working network without addressing the root cause.

Disable inter-VLAN routing and rely on Layer 2 flooding to deliver traffic between VLANs.

Why it fails: Layer 2 flooding cannot cross VLAN boundaries because each VLAN is a separate broadcast domain. Disabling routing would eliminate the working connectivity between VLAN 20 and VLAN 30 and would not make VLAN 40 reachable. This action misunderstands how inter-VLAN communication actually occurs, which always requires a Layer 3 function.

Root Guard

Why it fails: Root Guard is used to prevent a port from becoming the root port or the switch from becoming the root bridge. It does not affect the STP state transition timing. When a superior BPDU is received, the port is placed in a root-inconsistent state, which blocks traffic. It is unrelated to immediate forwarding for end devices.

Loop Guard

Why it fails: Loop Guard prevents a port from erroneously entering the forwarding state if BPDUs stop being received, which could cause a loop. It does not expedite the STP convergence for access ports. It is typically used on ports connecting to other switches, not on server ports that should immediately forward traffic.

BPDU Guard

Why it fails: BPDU Guard is a safety feature that disables a port if it receives a BPDU, which helps prevent loops when PortFast is enabled. It does not make the port transition immediately to forwarding; instead, it err-disables the port upon receiving a BPDU. It is often used in conjunction with PortFast but does not provide the fast transition itself.

show cdp neighbors gigabitEthernet 0/1

Why it fails: show cdp neighbors displays information about directly connected Cisco devices, including platform and port ID. It does not show duplex settings or error statistics for the local interface. While CDP can help map topology, it will not reveal a duplex mismatch or related errors on the port.

show controllers gigabitEthernet 0/1

Why it fails: show controllers is typically used on serial interfaces to display hardware-level information about the controller, such as cabling and clocking. It is not commonly used for Ethernet duplex or error statistics. On Ethernet ports, it may not provide duplex status or the specific error counters needed to diagnose a duplex mismatch.

show ip interface gigabitEthernet 0/1

Why it fails: show ip interface displays Layer 3 information such as IP address, subnet mask, and access lists applied to the interface. It does not show duplex settings or Layer 1/2 error statistics. Duplex mismatches are physical and data link layer issues, so this command will not provide the needed counters.

Single-mode fiber optic cable

Why it fails: Single-mode fiber requires an 'LR' (Long Range) or 'ER' (Extended Range) SFP module. Using single-mode fiber with an 'SR' module will cause significant signal loss or complete link failure because the light source and core diameter are not matched for the characteristics of single-mode glass.

Category 6a copper cable

Why it fails: The 'Te1/1/1' interface is an SFP+ slot populated with an optical transceiver, not a fixed RJ-45 copper port. While 10GBASE-T SFP modules exist for copper, the 'SR' designation specifically identifies an optical module that uses light pulses rather than electrical signals over twisted-pair copper cabling.

Twinaxial (DAC) copper cable

Why it fails: Direct Attach Copper (DAC) cables are integrated units where the SFP+ connectors are permanently attached to a twinaxial copper cable. While they fit in the same slot, the exhibit shows a specific 'SR' transceiver module is already installed, which requires a separate multi-mode fiber patch cord.

Configure port security on all access ports.

Why it fails: Port security restricts which MAC addresses can connect to a switch port, preventing unauthorized devices from accessing the network. While it enhances security, it does not directly isolate management traffic or secure remote management access. The engineer's goal is to protect management access, not to control endpoint devices, so this step is not the best fit.

Configure a default gateway on the switch.

Why it fails: A default gateway allows the switch to communicate with remote networks, which is necessary if management stations are on different subnets. However, it does not isolate management traffic or enforce authorization. While helpful, it is not a security step to restrict access, so it does not meet the requirement as directly as the correct options.

Enable DHCP snooping on the management VLAN.

Why it fails: DHCP snooping prevents rogue DHCP servers from assigning incorrect IP configurations. It is a security feature for client networks, not for isolating management traffic or securing remote access. The engineer's focus is on management access security, so DHCP snooping is irrelevant to this scenario.

show ip route

Why it fails: The 'show ip route' command is used on routers or Layer 3 switches to display the routing table, which contains Layer 3 (IP) destination networks. It does not show individual endpoint MAC addresses or the specific physical ports where local devices are connected at Layer 2.

show interfaces status

Why it fails: While 'show interfaces status' provides a helpful summary of port speeds, duplex settings, and whether a link is 'connected', it does not reveal the MAC address of the endpoint. It only tells you if the port is physically active, not which specific device is on the other end.

show running-config

Why it fails: The 'show running-config' command displays the current configuration of the switch, including port settings and VLAN assignments. However, it does not dynamically show the MAC addresses of connected endpoints, as those are learned in real-time and stored in the MAC address table, not the configuration.

Port security with sticky MAC address learning

Why it fails: Port security restricts which source MAC addresses may appear on a switch port and can shut the port or drop frames when a violation occurs. It operates at Layer 2 and has no concept of permitted management IP subnets, so it cannot selectively allow management stations by IP address or log denied IP-based attempts.

Dynamic ARP Inspection on all user-facing ports

Why it fails: Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table to stop ARP cache poisoning. It inspects ARP message contents at Layer 2 and does not filter general IP traffic by source subnet, so it cannot restrict which stations reach the management VLAN, and it produces no IP-based deny logging.

BPDU Guard enabled on access ports

Why it fails: BPDU Guard err-disables a port if it receives bridge protocol data units, protecting the spanning tree topology from rogue switches. It has nothing to do with permitting management source addresses; enabling it would not restrict access to the management VLAN and could actually disrupt legitimate edge devices that send BPDUs.

Dynamic Host Configuration Protocol (DHCP)

Why it fails: DHCP is responsible for assigning IP addresses to clients. Since the user can ping a public IP address, they clearly have a valid IP, subnet mask, and default gateway already assigned to their interface. If DHCP were failing, the user would likely have no connectivity at all or would be using an APIPA address.

Network Address Translation (NAT)

Why it fails: NAT allows private internal IP addresses to be translated into public addresses for internet access. If NAT were failing, the user would not be able to ping the public IP address '72.163.4.161' because their private packets would not be routable on the internet. Successful pinging proves that NAT is currently working correctly.

Address Resolution Protocol (ARP)

Why it fails: ARP resolves IP addresses to MAC addresses on the local network segment. If ARP were failing, the computer would not be able to send any packets to the local gateway, which would prevent both the ping to the IP and the attempt to reach the website. ARP is clearly functioning if any external traffic is successful.

802.1X authentication

Why it fails: 802.1X authenticates devices or users through a RADIUS server before granting access, using credentials or certificates from a supplicant, with MAC Authentication Bypass for devices without one. It is a stronger, identity-based control, but the requirement here is to list allowed MAC addresses manually on the port and shut it down on violation, which is exactly what port security with static addresses does.

DHCP snooping

Why it fails: DHCP snooping filters DHCP messages to prevent rogue DHCP servers. It does not control which MAC addresses can send traffic on a port. It is often used with DAI and IP Source Guard, but it does not provide the MAC address restriction and violation shutdown capability described in the scenario.

Dynamic ARP Inspection (DAI)

Why it fails: DAI validates ARP packets to prevent ARP spoofing, but it does not restrict which MAC addresses can send traffic on a port. It works with DHCP snooping to build a binding table. While it enhances security, it does not provide the port-level MAC address filtering and shutdown behavior required here.

It forwards the packet to all connected ports.

Why it fails: Unlike a switch, a router does not flood packets. Flooding is a Layer 2 switching behavior used for unknown unicast or broadcast frames. A router makes intelligent forwarding decisions, and if no route is found, it discards the packet to prevent network congestion.

It stores the packet until a route is learned.

Why it fails: Routers do not buffer or queue packets indefinitely while waiting for routing table updates. Buffering in this manner would lead to memory exhaustion and massive latency, so the standard procedure is to discard the packet immediately when no forwarding path exists.

It sends a request to the DNS server for the path.

Why it fails: DNS is used to map hostnames to IP addresses, not to provide routing path information. A router relies on its routing table and routing protocols to determine paths; it never queries a DNS server to decide where to send an IP packet.

Network 10.10.10.0, usable hosts 10.10.10.1 through 10.10.10.4

Why it fails: A /30 subnet contains only four addresses total, from .0 to .3. The address 10.10.10.4 falls in the next subnet, so it cannot be a usable host in this range. Claiming four usable hosts incorrectly ignores the reserved network and broadcast addresses.

Network 10.10.10.4, usable hosts 10.10.10.5 through 10.10.10.6

Why it fails: This range belongs to a different /30 subnet starting at 10.10.10.4. The given address 10.10.10.1 is in the 10.10.10.0/30 subnet, so this option misidentifies the network entirely. It would apply only if the interface were configured with 10.10.10.5/30 or similar.

Network 10.10.10.1, usable hosts 10.10.10.2 through 10.10.10.3

Why it fails: The network address must have all host bits set to zero. With a /30 mask, the address 10.10.10.1 has its lowest host bit set, so it is a usable host address, not the network address. The network is actually 10.10.10.0, not 10.10.10.1.

Check the switch interface status.

Why it fails: The switch interface status tells you if the physical link is up or down. While this is important, it does not tell you if the workstation has been assigned a valid IP address by DHCP or static configuration. It only confirms that the physical layer is connected.

Perform a traceroute to the local gateway.

Why it fails: A traceroute to the local gateway is meant to test path reliability. If the PC does not have a valid IP address, it will not be able to generate the packets necessary for a traceroute, making this test useless until the basic IP addressing has been verified first.

Reset the switch configuration.

Why it fails: Resetting a switch is a destructive action that will cause significant network downtime. It is never the correct step for troubleshooting a single workstation's IP addressing issue. This would impact every other device connected to the switch and is completely disproportionate to the problem of a single host.

The MAC address of the DHCP server.

Why it fails: While the client learns the server's MAC address through the Ethernet header of the DHCP messages, it is not a 'parameter' provided within the DHCP ACK payload for the client's configuration. The client does not store the server's MAC address as part of its permanent networking configuration settings.

The SSH private key for the management console.

Why it fails: DHCP is used for basic network provisioning and does not handle the distribution of sensitive security credentials like SSH private keys. Security features like SSH require separate configuration or specialized deployment tools. Including such information in a DHCP broadcast would be a significant security risk to the entire network environment.

The physical cable is disconnected.

Why it fails: If the physical cable were disconnected, the interface status would show as 'down/down' or 'administratively down'. The 'up' status for the first part of the output indicates that the hardware detects a carrier signal from the connected endpoint, confirming that the physical electrical connection is intact.

The switch port has been administratively disabled.

Why it fails: If the administrator had manually disabled the port using the shutdown command, the output would clearly state 'administratively down, line protocol is down'. Since the interface is 'up', it means the port is enabled and attempting to communicate with the device on the other end.

The MAC address on the server is incorrect.

Why it fails: MAC addresses are burned into the hardware and do not cause a line protocol to go down simply by being 'incorrect'. The switch learns MAC addresses from incoming frames; while a security policy like Port Security might disable a port, it would typically result in an err-disabled state.